[hackerone] Remove onion services from window.location.ancestorOrigins

[diracdeltas]

The window.location.ancestorOrigins API is currently separate from any referrer interventions and so while we removed .onion hostnames from cross-origin referrers, these .onion hostnames are still visible via the ancestorOrigins API.

We should follow a similar policy as what we did on the referrer side: omit .onion origins (replacing them with "null") unless they are same-origin with the innermost frame.

Given the direction of whatwg/html#2480 and the fact that I already proposed changing the referrer in w3c/webappsec-referrer-policy#156, if Firefox ever implements this API, it will likely be done in the way that they have discussed publicly and then our implementation will be the natural way to fix this in the Tor browser too.

Originally reported on https://hackerone.com/reports/2117537 by xiaoyinl

[stephendonner]

Verified PASSED using

Brave | 1.62.33 Chromium: 119.0.6045.105 (Official Build) nightly (x86_64)
-- | --
Revision | f2e65ce54724df1b0d04a6f8b50ab9d97779a5b5
OS | macOS Version 14.2 (Build 23C5030f)

Steps:

1. installed 1.62.33
2. launched Brave
3. clicked on the "hamburger" menu
4. clicked on New Private Window with Tor
5. loaded http://ixrdj3iwwhkuau5tby5jh3a536a2rdhpbdbu6ldhng43r47kim7a3lid.onion/referrer/onion.html
6. compared the results of the two <iframe> tests below with those from the test plan

Confirmed the results of the output match those provided in the test plan

Sub-resources, same-origin	Sub-resources, cross-origin <iframe>s

[MadhaviSeelam]

Verification PASSED using

Brave | 1.62.105 Chromium: 120.0.6099.71 (Official Build) beta (64-bit)
-- | --
Revision | f72c783bcd52110d026061575b4bef28ccb547f7
OS | Windows 11 Version 22H2 (Build 22621.2715)

Steps:

1. installed 1.62.105
2. launched Brave
3. clicked on the "hamburger" menu
4. clicked on New Private Window with Tor
5. loaded http://ixrdj3iwwhkuau5tby5jh3a536a2rdhpbdbu6ldhng43r47kim7a3lid.onion/referrer/onion.html
6. compared the results of the two <iframe> tests below with those from the test plan

Confirmed the results of the output match those provided in the test plan

Sub-resources, same-origin	Sub-resources, cross-origin <iframe>s

[LaurenWags]

Verified with

Brave	1.62.112 Chromium: 120.0.6099.115 (Official Build) beta (64-bit) 
Revision	ae1e179b9884b2de2f4ba0bdea7da3beaad93ffa
OS	Linux

Verified the test plan from brave/brave-core#20622 (comment).

Steps:

1. installed 1.62.x
2. launched Brave
3. clicked on the "hamburger" menu
4. clicked on New Private Window with Tor
5. loaded http://ixrdj3iwwhkuau5tby5jh3a536a2rdhpbdbu6ldhng43r47kim7a3lid.onion/referrer/onion.html
6. compared the results of the two <iframe> tests below with those from the test plan

Confirmed the results of the output match those provided in the test plan

Sub-resources, same-origin	Sub-resources, cross-origin <iframe>s